CVE-2024-45598
📋 TL;DR
This vulnerability in Cacti allows administrators to read arbitrary local files on the server by manipulating the Poller Standard Error Log Path parameter and accessing the Logs tab. The issue affects Cacti installations prior to version 1.2.29 where administrators have access to configuration settings.
💻 Affected Systems
- Cacti
📦 What is this software?
Cacti by Cacti
⚠️ Risk & Real-World Impact
Worst Case
Administrator reads sensitive system files (e.g., /etc/passwd, SSH keys, database credentials) leading to privilege escalation or lateral movement within the environment.
Likely Case
Administrator reads application configuration files containing database credentials or other sensitive information stored on the local filesystem.
If Mitigated
Limited to reading files accessible to the web server user account, with no ability to modify files or execute commands.
🎯 Exploit Status
Exploitation requires administrator credentials. The attack involves simple configuration changes and UI navigation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.29
Vendor Advisory: https://github.com/Cacti/cacti/security/advisories/GHSA-pv2c-97pp-vxwg
Restart Required: No
Instructions:
1. Backup your Cacti database and configuration. 2. Download Cacti 1.2.29 from the official repository. 3. Replace existing Cacti files with the new version. 4. Run database upgrade if prompted. 5. Verify functionality.
🔧 Temporary Workarounds
Restrict Administrator Access
allLimit administrator accounts to trusted personnel only and implement strong authentication controls.
File System Permissions
linuxRestrict web server user permissions to sensitive directories using filesystem ACLs.
chmod 600 /path/to/sensitive/files
chown root:root /path/to/sensitive/files
🧯 If You Can't Patch
- Implement strict access controls for administrator accounts and monitor administrator activities.
- Apply filesystem permissions to restrict web server user access to sensitive files and directories.
🔍 How to Verify
Check if Vulnerable:
Check Cacti version via web interface or by examining the Cacti installation directory for version files.Check Version:
grep 'version' /path/to/cacti/include/global.php | grep -o '[0-9]\+\.[0-9]\+\.[0-9]\+'Verify Fix Applied:
Verify Cacti version is 1.2.29 or later and test that changing Poller Standard Error Log Path no longer allows arbitrary file reading.📡 Detection & Monitoring
Log Indicators:
- Unusual administrator logins
- Changes to Poller Standard Error Log Path configuration
- Access to non-standard log files
Network Indicators:
- HTTP requests to Logs tab with unusual file parameters
SIEM Query:
source="cacti.log" AND ("Poller Standard Error Log Path" OR "log_file_path")